Elevating security with expert offensive strategies
Long Beach
Joined October 2024
- Tweets295
- Following83
- Followers1.1K
- Likes3.6K
We are still growing the course a little more before release but we added some latest redirection techniques, sign up at training.init1security.com ready for release on 🎃⚔️🥳
SQL is still an important part of Active Directory, so we had to bring it to the training and demonstrate the powerful capabilities of powershell and how it can abuse SQL. The training will still grow even after release to catch up with the latest attacks!! Sign up release Oct 31!! 🎃
training.init1ssecurity.com
Init1Security retweeted
It has been a quieter month than usual for iPurple blogging, as I have been working on content for a number of upcoming projects and activities.
A new article will be published early next week. In the meantime, have a look at my latest post on leveraging WerEnc.dll to encrypt your implant.
Why use it?
✅ Smaller stagers by reusing encryption code already built into Windows
✅ AES-256 encryption support
✅ Trusted, signed Microsoft DLL
Living-off-the-land encryption has its advantages.
ipurple.team/2026/09/21/dump…
🚨 Release: October 31 🚨
🔥 20+ AD Attacks
📂 10+ Initial Access File Formats
📦 6+ Containers
🔒11+ Persistence Techniques
Built for Red Team training, featuring a growing arsenal of techniques, including BOFs, patched Open Source tools and Custom Tools available for students.
This is just the foundation. More techniques, features, and improvements are on the way in the near future.
October 31. Get ready. 🎃
#RedTeam #CyberSecurity #ADSecurity
We "fixed" ISO's!!. Not really but the hidden attribute has been patched for latest Win11, a simple bit flip and the attribute is back, PhantonMount will be our tool offered for students to get back on utilizing ISO containers on our RTO Course.
We did it! We properly extracted and analyzed the 3 most popular browsers and built the BOFs for Havoc, all attacking the latest versions and extract credentials from them.
Exciting news for the training!
training.init1security.com
LLM for CyberSecurity according to Anthropic
anthropic.com/research/glm-5…
ANIMO has extensive capabilities to look at SPNs
github.com/dmcxblue/ANIMO
Microsoft Security Research has identified extensive cloud resource destruction activity linked to JADEPUFFER, which Microsoft tracks as Storm-3168. The activity used compromised service principals and performed cloud credential collection that could be used to facilitate future exfiltration. msft.it/6015a9lob
Two compromised service principals divided discovery, destruction, and credential collection, with timing and overlapping token streams strongly indicating automated or scripted execution that included more than 100 storage account deletion attempts in about seven minutes.
Discovered by Sysdig in July 2026, JADEPUFFER is reported to be the first documented agentic ransomware operation. These new findings expand publicly documented activity associated with Storm-3168 and indicate an evolution in the threat actor's cloud operations.
Read the blog for analysis, Microsoft Defender detections, and mitigation guidance on protecting workload identities, revoking or rotating exposed credentials, and safeguarding backup and recovery resources.
New Tool: skeletonToken
A new tool inspired by the classic Skeleton Key technique from Mimikatz, designed to forge valid TGTs for domain users on Windows Server 2025.
Exciting news for our course skeletonToken will ship Day 1 with Havoc.
We stripped down Mimikatz, the powerful credential extraction tool, and took it further.
This BOF can now grab hashes from Windows 11 and Windows Server 2025, fully integrated into Havoc.
Another feature now available for students. 🔥 We are still dissecting the powerful functions from mimikatz for other modules, exciting news coming up!!
Introducing ACLPWN a BOF for abusing ACL permissions in Active Directory.
GenericAll
GenericWrite
WriteDACL
WriteOwner
ExtendedRight(Force-Change-Password)
AddMember
GetChanges + GetChangesAll
If you can write it, you can own it!!. BOF available Day 1 on our training sign up for notifications!!!: training.init1security.com
Resource-Based Constrained Delegation a technique that requires specific tools and permissions for it to function so we created them for Havoc standIn BOF which is a stripped down version of the .NET binary project as well as an updated Rubeus which now handles the latest encryption for Windows Servers and extra functions that allow us to change the encryption type when working with Tickets.
Evasion & Policies from our RTO Course meant bringing back a popular C2: Koadic C3.
We gave this awesome project new stagers, migrated it to Python 3, and brought it back to life.
It’ll be available to all students. This was a seriously fun project to revive. 🔥
An incredible project, capabilities all within the browser, Nice!!
Hi everyone! I'd like to share with you the research of my colleague Vyacheslav Tsepennikov, who successfully ported numerous offensive tools into the browser! With iwa-tools, you can run all pentest tools from Chrome!
Check it out:
iwa-tools.pkilla.pw/
github.com/CICADA8-Research/…
The RTO course dives into some interesting techniques from Redirectors and Malleable Profiles to Enumeration.
One enumeration technique demonstrates User Monitoring, and we’re taking that concept further by upgrading the open-source Havoc C2 with a new functionality "LiveDesktop".
These additions are open-source and designed to be easily integrated into other open-source C2 projects.
Our internal AI Agent, PEARCE, has made implementing these newer functions significantly easier.
Learn more at: training.init1security.com
Hackers usually start with game hacking, so what are we doing here at init1?
We’re building a Hacker Game entirely in your terminal, using your tools, on your host. With battle tested scenarios!!
Bring your custom tools, build your own workflow, or use any open-source tools you want.
A hacking game built for hackers. Get ready, Gamers & Hackers. No Spoilers🔥
#DEADKRECKONING
